fix(lifecycle): rebuild bounded artifact serialization on current main

[seonghobae]

Objective

Reconcile one unique, path-bounded lifecycle delta from stale descendant #268 onto the current protected baseline after #270 integrated. Conversion and deletion work for the same permanently reserved job identifier need one process-local serialization boundary so metadata/artifact actions cannot overlap inside the standalone JVM while the broader durable deletion stack is rebuilt in smaller current-base slices.

Exact test-first state

Protected main is exact 55d7ae8647208e301f282350f076eeddaba61d11. This Draft starts intentionally RED at exact test-only head fa95b6b48b136bcb5fe81a587fda23b4fc1e239c, directly based on that protected main.

ArtifactLifecycleLockRegistryTest is copied from stale descendant #268's unique lifecycle evidence and requires: same-job mutual exclusion under concurrent actions; release after an action throws; bounded stripe construction; null-input failure; default construction; and one shared standalone registry. The production type is intentionally absent at this head, so Maven test compilation must fail at that exact boundary.

Stale-descendant convergence

#268 is now a 181-commit, 139-file Draft that is not mergeable against current protected main. This PR does not pretend that retargeting or its PR-body ancestry reconciles that stale branch. It preserves only the ArtifactLifecycleLockRegistry semantic delta plus focused tests on the exact post-#270 protected baseline. Remaining #268 lifecycle/security deltas stay open for deliberate bounded reconstruction or technically justified supersession; no source from current protected main is overwritten.

Scope

New lifecycle lock registry plus focused regression only. It does not implement the durable deletion receipt/ledger/coordinator, distributed generation fencing, tenant authorization, deletion API/UX, artifact cleanup, or issue #263 completion. The registry is explicitly a standalone-process reference boundary; multi-instance durability still requires the durable generation/transactional semantics owned by issue #263/#312.

Acceptance

Observe exact-head RED -> add the smallest reviewed production implementation from #268 -> exact-head mvn -B --no-transfer-progress verify with zero missed owned production lines/branches and warning-free public Javadocs -> CI/Security Scan/SAST/fuzz where emitted -> exact reviews/threads/live-base refetch. Keep Draft until the unchanged exact head is GREEN. Independent non-author write-authorized approval remains a separate protected-merge gate.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0f9febbb-f3b2-484b-89ad-c0f5b47b74b3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing as an exact duplicate of existing active PR #350 after fresh current-base comparison. #350 is already directly based on protected main 55d7ae8647208e301f282350f076eeddaba61d11, has the same two changed blobs (ArtifactLifecycleLockRegistry.java 8bb61c26… and ArtifactLifecycleLockRegistryTest.java c09be637…), and its exact head 914b7e566a41766d05caca425f767243482240fb already has CI, Security Scan, SAST Semgrep, and fuzz successful. The duplicate branch here adds no unique semantic delta. Preserve #350 as the sole writer/merge lane for this lifecycle primitive; no evidence from this duplicate is needed for #350.